Skip to main content

Create role

POST 
/metalakes/:metalake/roles

Creates a role with the given properties and securable objects, and returns the new role. Every securable object must exist, and each privilege must be one that the object's type supports.

Sign in with a bearer token or a local user's password; see Authentication.

Request​

Path Parameters

    metalake stringrequired

    The name of the metalake

Body

    name stringrequired

    The name of the role

    properties

    object

    nullable

    A map of properties for the role

    property name* string

    securableObjects

    object[]

    A list of securable objects

  • Array [

    • fullName stringrequired

    The full name of the securable object

    type stringrequired

    Possible values: [metalake, catalog, schema, fileset, table, view, topic, model, tag, policy, job_template, function]

    The type of the securable object. Only types that at least one privilege can be bound to are accepted, and each privilege in privileges must support the type. Responses return the value in lowercase; requests accept any case.

    privileges

    object[]

    A list of privileges

  • Array [

    • name stringrequired

    Possible values: [create_catalog, use_catalog, create_schema, use_schema, create_table, modify_table, select_table, create_fileset, write_fileset, read_fileset, create_topic, produce_topic, consume_topic, manage_users, manage_groups, create_role, manage_grants, register_model, create_model, link_model_version, create_model_version, use_model, create_tag, apply_tag, create_policy, apply_policy, register_job_template, use_job_template, run_job, create_view, select_view, register_function, execute_function, modify_function, use_secrets, include_credential_secrets]

    The name of the privilege, one of the values of Privilege.Name. Responses return the name in lowercase; requests accept any case. create_model and create_model_version are deprecated: the server still accepts them as aliases of register_model and link_model_version, and new requests should use the new names.

    condition stringrequired

    Possible values: [allow, deny]

    The condition of the privilege, allow or deny. Responses return the value in lowercase; requests accept any case.

  • ]

  • ]

Responses​

The new role, with its properties, its securable objects with their privileges, and its audit information.

Schema

    code int32

    Possible values: [0]

    Status code of the response

    role

    object

    name stringrequired

    The name of the role

    properties

    object

    nullable

    A map of properties for the role

    property name* string

    securableObjects

    object[]

    A list of securable objects

  • Array [

    • fullName stringrequired

    The full name of the securable object

    type stringrequired

    Possible values: [metalake, catalog, schema, fileset, table, view, topic, model, tag, policy, job_template, function]

    The type of the securable object. Only types that at least one privilege can be bound to are accepted, and each privilege in privileges must support the type. Responses return the value in lowercase; requests accept any case.

    privileges

    object[]

    A list of privileges

  • Array [

    • name stringrequired

    Possible values: [create_catalog, use_catalog, create_schema, use_schema, create_table, modify_table, select_table, create_fileset, write_fileset, read_fileset, create_topic, produce_topic, consume_topic, manage_users, manage_groups, create_role, manage_grants, register_model, create_model, link_model_version, create_model_version, use_model, create_tag, apply_tag, create_policy, apply_policy, register_job_template, use_job_template, run_job, create_view, select_view, register_function, execute_function, modify_function, use_secrets, include_credential_secrets]

    The name of the privilege, one of the values of Privilege.Name. Responses return the name in lowercase; requests accept any case. create_model and create_model_version are deprecated: the server still accepts them as aliases of register_model and link_model_version, and new requests should use the new names.

    condition stringrequired

    Possible values: [allow, deny]

    The condition of the privilege, allow or deny. Responses return the value in lowercase; requests accept any case.

  • ]

  • ]

    • audit

    object

    Audit information for a Gravitino resource.

    creator string

    The user who created the resource

    createTime date-time

    The time the resource was created

    lastModifier string

    The user who last modified the resource

    lastModifiedTime date-time

    The time the resource was last modified

Loading...
Last updated on